AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Apache AirflowGHSA-c732-xvv8-g94c

Command Injection in Apache Airflow and Apache Airflow MySQL Provider

Apache Airflow

CVE-2023-22884 · Published Jan 21, 2023 · updated Oct 27, 2026

Critical9.8
Fix: upgrade to 2.5.1 or later
GitHub advisory

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow, Apache Software Foundation Apache Airflow MySQL Provider.This issue affects Apache Airflow: before 2.5.1; Apache Airflow MySQL Provider: before 4.0.0.

Affected versions

PackageAffectedFixed in
apache-airflow
PyPI
< 2.5.12.5.1
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-77
Also known as
BIT-airflow-2023-22884, CVE-2023-22884, PYSEC-2026-268, PYSEC-2026-279

More Apache Airflow advisories

All Apache Airflow
Medium 5.3Mar 15, 2023Sensitive Information in Error Messages in Apache AirflowCVE-2023-25695fixed in 2.5.2rc1Critical 9.8Feb 24, 2023Improper Input Validation vulnerability in the Apache Airflow Sqoop ProviderCVE-2023-25693fixed in 3.1.1Medium 5.5Nov 22, 2022OS Command Injection in Apache AirflowCVE-2022-40954fixed in 2.3.0Critical 9.8Nov 22, 2022OS Command Injection in Apache AirflowCVE-2022-38649fixed in 2.3.0Critical 9.8Nov 22, 2022OS Command Injection in Apache AirflowCVE-2022-40189fixed in 2.3.0Medium 6.1Nov 15, 2022Apache Airflow Contains Open RedirectCVE-2022-45402fixed in 2.4.3